Disaster Recovery: Its Not Only IT’s Problem · 4 employees in IT, which is why only 1 in 5 companies have one person responsible for disaster recovery. Most firms share responsibility

Disaster Recovery: Its Not Only IT’s ProblemAn IDC InfoBrief, sponsored by TeraGo May 2019

#MAN145006719

IDC InfoBrief Disaster Recovery: Its Not Only IT's Problem

Sponsored by TeraGo Page 2#MAN145006719

Changing World, Changing Resiliency Requirements

Source: IDC Canada Top Executive Survey, 2019

Top executive concern is management of risk.• Canadian organizations continue to place operational efficiency, productivity gains,

and market expansion as their top business imperatives in today’s increasingly digital‑led economy as worldwide competitors can reach into local markets across Canada.

• To support this changing market environment, organizations are investing in initiatives to meet their changing IT requirements. They are lowering their security risk, making their applications ready for digital channels. They are also virtualizing their IT infrastructure and using cloud services for more uptime and lower cost. And they are getting more business and customer insights through business analytics.

• Information security is critically important in the digital economy. In fact, 41% of Canadian organizations say it is a key inhibitor to their use of digital technologies.

Top IT Initiatives

IT operations automation 14%

Supply chain 15%

Collaboration technologies 16%

Mobile technologies 17%

Customer experience 17%

Business analytics 25%

Cloud services 27%

Infrastructure virtualization 30%

Application modernization 32%

Security/risk management 34%



Importance of Disaster Recovery Planning

Source: IDC survey of Disaster Recovery in Canada, sponsored by TeraGo, Q4 2018

As Canadian organizations enhance their readiness to meet the challenges of the digital economy, they may be underestimating the importance of disaster recovery planning to improve the resiliency of their business operations.

The good news is that only 16% of respondents surveyed said executive management in their organizations ignore disaster recovery.

The bad news is that 77% of senior executives in Canada still see disaster recovery and business continuity as a challenge.

Organizations are also certainly underestimating the cost of downtime. Of those organizations with disaster recovery plans, only 49% have attempted to measure the direct and indirect costs of downtime. They may be surprised to learn that IDC research has determined the average cost of downtime is $250,000 per hour in terms of direct costs to recovery and indirect costs of lost revenue and lost productivity. The intangible costs of corporate reputation and customer goodwill may be even greater.

More companies are considering disaster recovery to enable business resiliency because they know few organizations could conduct business for any meaningful length of time without access to their critical applications and data. They can no longer look at disaster recovery like an insurance policy — an expense with little payback.

Organizations are also certainly underestimating the cost of downtime. Of those organizations with disaster recovery plans, only 49% have attempted to measure the direct and indirect costs of downtime. They may be surprised to learn that IDC research has determined the average cost of downtime is $250,000 per hour in terms of direct costs to recovery and indirect costs of lost revenue and lost productivity. The intangible costs of corporate reputation and customer goodwill may be even greater.



How Disaster Recovery is Done Today


Data Recovery Approach

57%DIY on‑premise

13%DIY off‑site

9%DIY cloud‑based

13%

3rd partymanaged

on‑premise

6%3rd party managed off‑site

2%3rd party managed cloud‑based

Midsize organizations approach to disaster recovery can be described as dominated by the IT department, in a “do‑it‑yourself” and “on‑premise” approach.

79% of midsize organizations take a do-it-yourself approach to disaster recovery, while 21% use a third-party provider to help manage it.

70% of organizations that keep their data and infrastructure needed to recover from disasters in their on-premise datacenters.



What are the Drawbacks of How Disaster Recovery is Done Today?


IDC believes the approach to disaster recovery used by most midsize organizations has several drawbacks.

• Many IT departments lack the maturity in their disaster recovery processes to consider the many causes of a disaster scenario, from fires and earthquakes to broken pipes and electricity outages. Often, organizations rely on the heroic efforts of highly skilled employees to recover.

• The do‑it‑yourself approach stretches small IT departments too thinly. The typical midsize company has only 4 employees in IT, which is why only 1 in 5 companies have one person responsible for disaster recovery. Most firms share responsibility for disaster recovery across the IT staff. This can pose a challenge in ensuring all staff involved are truly trained and knowledgeable in disaster recovery.

• Place the crown jewels in a safe deposit box. Keeping data and infrastructure used to recover from disasters in on‑premise datacenters breaks a well‑known principal in IT planning — maintain backup copies off site. In many situations, the disaster that caused failure will affect the entire datacenter, including what is needed to restore to minimum operations.



State of IT Disaster Preparedness Today


As the importance of disaster recovery planning increases and the drawbacks of current approaches in managing disaster recovery are realized, organizations begin to get a sense of how prepared they are in their ability to recover from disasters.

Completely Mostly Unprepared

Senior ManagerC-level VP Director

14%

59%

27%16%

25% 24%

53%

53%

22% 24%

52%

32%

Data Recovery Preparedness by Role

23% of midsize companies believe they are completely prepared. Another 53% are mostly prepared. Yet 1 in 4 midsize firms (24%) believe they are unprepared to recover from disasters.

Interestingly, C-level executives are more likely to believe they are more prepared than people lower in the organization.



21 3 4 5

Extremelyconfident

Not at allconfident

Unprepared Mostly Completely

Personnel have the skills required andare available to implement the plan

Ensures that all systems and processeswill be recovered eventually

Ensures that all data will berecovered eventually

Adaptable to applications whichfrequently are updated

Handle any potential scenario

Meet all time and workload targets forrecovery of all systems and processes

Meet all organizational time and workloadtargets for recovery of all data

How Much Confidence do Firms Really Have?


Confidence in Disaster Recovery Plan

Companies are hedging their opinions about their disaster preparedness. They know they are mostly prepared, which gives them confidence in their ability to recover from disasters.

Yet these C-levels tend to have more confidence in their people and their plans, rather than the business outcomes in terms of actually being fully operational.

C-level thinks their organizations are more prepared yet they also have lower average confidence in their disaster recovery plans than others lower in the organization.



Mission Critical or Mission Impossible?


Completely Mostly Unprepared

6%

38%

56%

36%

48%

13%

4%

18%

42%

36%

3%

Yes

Yes — but expectations should be higher

— our DR expectations align to available budget

No — expectations are too high for the budget

No — IT DR budget is fine but recovery expectations are too high

Disaster Recovery Expectations Relative to BudgetMidsize organizations are least confident about meeting organizational targets to restore systems, processes, and data. IDC believes this is due to the expectations those targets are based on, in terms of what workloads are mission critical in a disaster scenario, and in how much time they should be restored.

Midsize organizations surveyed by IDC said that 40% of workloads are mission critical, and they expect those workloads to be restored within two hours.

C-level executives expect mission critical workloads to be recovered in within one hour.

With high expectations of number of mission-critical workloads to recover and the speed to recover them, midsize organizations may be trying to achieve the impossible.

When asked to compare their expectations to the disaster recovery budget, only those that believe they are completely prepared say their expectations meet budget. Organizations that are mostly prepared think their expectations — and their budgets — should be higher. And the companies that believe they are unprepared say they have a mismatch between budget and expectations.



Planning for Resiliency the Right Way

Best Practice Description Recommended Frequency

Business impact assessment Analyze the financial and process impact of a major disruption Quarterly

Risk assessment Analyze the scenarios for the business processes at greatest risk Semi-annually

Strategy review Review and assess the strategy, based on recorded incidents Quarterly

Test and validate Clearly scope the plan's success criteria and roles/responsibilities of the test participants

Plan a post-test review and revision as needed

Quarterly

Audit Walk through the plan step-by-step Quarterly

Determine costs Calculate direct and indirect costs of downtime so they are well understood within the organization Annually


The majority of midsize organizations believe they are mostly prepared yet think their recovery expectations should be higher. They can look to their peers that are completely prepared for disaster recovery to learn more.

Good disaster recovery planning incorporates six key elements. The best practices of those that are completely prepared can guide their peers on how to plan for resiliency.

Prepared organizations have appropriate technologies, defined processes, and trained staff to survive a disaster event.



Where do Organizations Need Help in Disaster Recovery Planning


Not saving enough data

Keep plan up to date

No testing plan

Prioritizing the resources to restore first

Redundant infrastructure

Adequate documentation of plan

Risk of breach of customer contracts

Maintain regulatory compliance

Qualified staff to implement plan

Identifying all risk factors 65%

55%

54%

50%

49%

48%

44%

41%

41%

48%

Top Concerns of Disaster Recovery Planning

Concerns include Yes/Not Sure responses of companies that are Mostly Prepared

• Improving organizational preparedness to recover from disasters is no easy task.

• Most midsize companies want to be completely prepared for disasters rather that just mostly prepared require assistance to achieve that objective.

• The study found the top concerns of organizations that are mostly prepared for disasters involve both creating a plan and implementing that plan. The need to be able to identify all risk factors and ensure the firm does not breach regulations or customer commitments is widely shared. Knowing which resources to restore first is critical when creating the plan.

• Concerns about implementing the plan are also widely shared. Having qualified staff is a common theme in IT today. Giving staff enough time and knowledge to properly document, test, and keep disaster recovery plans up to date is an important concern when employees are stretched thin, as most IT departments are today.

Staffing ranks high with companies well prepared for disaster recovery



Business IT Initiatives

Manufacturers prefer system integrators, with local and international reach, for hosting and cloud services.

Sources: IDC LOB Functional Survey 2017, 2018 TeraGo Disaster Recovery Study

Manufacturing SectorDisaster recovery tends to become second to customer experience

Issues Affecting the Industry

Adoption and Provider Preferences

»Reduce operational costs »Regulatory compliance »Security and resiliency

»Application modernization »Business analytics » Infrastructure consolidation

More likely to host applications, DR, and backup. App hosting is more common than others.

Above average use of cloud services (~half of firms using cloud service), led by backup and SaaS.

Manufacturing sector characterized by above‑average readiness for disaster recovery versus other industries. Cloud disaster recovery solutions are common.


Sponsored by TeraGo Page 12#MAN145006719Source: IDC survey of Disaster Recovery in Canada, sponsored by TeraGo, Q4 2018

How do Five Key Industries Perform on Disaster Recovery?Issue IT Industry Financial Services Business Services Retail Manufacturing

Average IT Staff

Hosted Disaster Recovery

Hosted Backup

Cloud Disaster Recovery

Cloud Backup

Number of Mission Critical Workloads

Confidence in Disaster Recovery Plan

Disaster Recovery Plan Review Frequency

Disaster Recovery Test Comprehensiveness

Typically used Disaster Recovery plan

Disaster Recovery preparedness

Number of Concerns of Disaster Recovery Plan

Measured cost of downtime

Above average Average Below average



Reputation

Technical support capabilities

Security certifications

Existing relationship

Ability to transfer knowledge

Total solution provisioning

Industry expertise

Pricing

Criteria to Consider When Selecting an MSPWhat to Look For in a Provider

• As a majority of midsize companies have a challenge with having enough qualified staff for their disaster recovery needs, it is not surprising that more firms are seeking new solutions to address their needs.

• Managed service providers (MSPs) play an important role here as their customers rely on them when disruptions occur. Unlike consultants, which typically help in the design stage, managed service providers provide ongoing management and support, typically with service level commitments for recovery time objectives (RTOs) and recovery point objectives (RPOs).

• MSPs have the ability to leverage their investments in datacenters, network infrastructure, and backup and disaster recovery technologies, plus their trained and expert staff with the experience of supporting many customers, and their knowledge of best practices in IT operations and disaster recovery methodologies. Individual customers benefit from the knowledge of many when working with an MSP.



What’s Next? Where do You Begin?

What is our DR strategy?Are we completely prepared?

Do we have input from all departments?

Do we have the right balance of people, technology andprocesses to recover from

disruptions?

Does our DR spending match our expectations for

recovery?

Where should we follow the best practices of our peers to enhance our preparedness?

Are we working with the right partners?

Getting from mostly prepared to completely prepared is feasible. Companies with that objective should ask themselves essential questions before starting that journey.

Improving disaster preparedness begins with business leaders recognizing that disaster recovery is not only IT’s problem.

Documents

Disaster Recovery: Its Not Only IT’s Problem · 4 employees in IT, which is why only 1 in 5 companies have one person responsible for disaster recovery. Most firms share responsibility